Revision: 2236
Author: andreassolberg
Date: Wed Mar 24 23:40:23 2010
Log: XSS fix for metaedit module
http://code.google.com/p/simplesamlphp/source/detail?r=2236
Modified:
/trunk/modules/metaedit/templates/metalist.php
=======================================
--- /trunk/modules/metaedit/templates/metalist.php Thu May 21 11:56:08 2009
+++ /trunk/modules/metaedit/templates/metalist.php Wed Mar 24 23:40:23 2010
@@ -21,8 +21,8 @@
foreach($this->data['metadata']['mine'] AS $md ) {
$i++;
echo('<tr class="' . $rows[$i % 2] . '">
- <td>' . $md['name'] . '</td>
- <td><tt>' . $md['entityid'] . '</tt></td>
+ <td>' . htmlspecialchars($md['name']) . '</td>
+ <td><tt>' . htmlspecialchars($md['entityid']) . '</tt></td>
<td>
<a href="edit.php?entityid=' . urlencode($md['entityid']) .
'">edit</a>
<a href="index.php?delete=' . urlencode($md['entityid']) .
'">delete</a>
@@ -41,9 +41,9 @@
foreach($this->data['metadata']['others'] AS $md ) {
$i++;
echo('<tr class="' . $rows[$i % 2] . '">
- <td>' . $md['name'] . '</td>
- <td><tt>' . $md['entityid'] . '</tt></td>
- <td>' . (isset($md['owner']) ? $md['owner'] : 'No owner') . '
+ <td>' . htmlspecialchars($md['name']) . '</td>
+ <td><tt>' . htmlspecialchars($md['entityid']) . '</tt></td>
+ <td>' . (isset($md['owner']) ? htmlspecialchars($md['owner']) : 'No
owner') . '
</td></tr>');
}
if ($i == 0) {
--
You received this message because you are subscribed to the Google Groups
"simpleSAMLphp commits" group.
To post to this group, send email to [email protected].
To unsubscribe from this group, send email to
[email protected].
For more options, visit this group at
http://groups.google.com/group/simplesamlphp-commits?hl=en.
